Mobile nodes such as cellular phones, personal digital assistants (PDAs) and notebook computers often require authentication when accessing remote databases or networks.
In prior systems, a centralized authentication procedure is followed where a single Infrastructure Access Point (IAP), such as a base station, handles an authentication process for all nodes within range of the IAP. For instance, systems which adhere to American National Standards Institute/Institute of Electrical and Electronics Engineers (ANSI/IEEE) 802.1X or ANSI/IEEE 802.11i standards utilize such a centralized procedure to control access to network resources.
IEEE 802.1X is an IEEE standard initially designed to provide authentication, access control, and key management in both wired and wireless networks. Three entities defined in 802.1X are a Supplicant, an Authenticator and an Authentication Server (AS). The Supplicant is the node seeking authentication and access authorization. The Authenticator or Network Access Server (NAS) is the node with which the Supplicant communicates directly. The AS, sometimes referred to as the Authentication, Authorization and Accounting (AAA) Server, authenticates and grants access, if authorized, to a Supplicant based on the Supplicant's credentials. An AS can be co-located with an Authenticator. Authentication is conducted between the Supplicant and the Authentication Server while the Authenticator acts as a pass-through of the authentication messages. The Authenticator has an uncontrolled port and a controlled port for every client. Before a client is authenticated, only authentication messages are allowed to pass through the uncontrolled port. Only after the Supplicant is successfully authenticated can other traffic be passed via the controlled port.
A protocol used for these communications between the Supplicant and the Authentication Server is EAP (Extensible Authentication Protocol). For 802.1X, EAP messages between the Supplicant and the Authenticator are encapsulated in EAPOL (EAP over local area network (LAN)) message formats. EAP is flexible and extensible in supporting multiple authentication mechanisms such as user password, certificate based authentication, one time password, authentication token or smart card, and the like. It provides a vehicle to negotiate and use appropriate authentication mechanisms including those which derive keying material at the Supplicant and the AS.
An authentication procedure can begin when a node transmits an authentication request using, for example, an Extensible Authentication Protocol (EAP) comprising EAP Over Local Area Network (EAPOL) packets. The authentication process involves several EAPOL packets being transmitted and received, beginning with an EAP start packet and finishing with either an EAP success message packet or an EAP failure message packet. The authentication server stores the authentication credentials of a mobile device (typically called a Supplicant) that is being authenticated. Authentication servers also can be connected to other authentication servers to obtain Supplicant authentication credentials that are not stored locally.
As described in the “IEEE Standard for Local and metropolitan area networks—Port-Based Network Access Control”, IEEE 802.1X-2001, June 2001, Supplicants (or nodes seeking to authenticate and gain access) are assumed to be one hop from the Authenticator (e.g., an intelligent access point (IAP)) which grants or refuses access. Traditional 802.1X does not contemplate multi-hop communication between the Supplicant and the Authenticator. Because every Supplicant can be authenticated only via an IAP, such a centralized procedure might not be practical in ad hoc wireless communication networks that have nodes outside of the wireless communication range of an IAP.
Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of embodiments of the present invention.